Skip to content
Sign in
5.9 Medium

CVE-2022-40234 Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a…

Description

Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.

Affected products and versions

Product Affected versions Fixed in
Spectrum Protect Plus 10.1 10.1.0 → 10.1.11 No fix stated

Other CVEs of Spectrum Protect Plus

The 49 CVEs of Spectrum Protect Plus →
CVE-2020-4497 IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in… 6.8 Medium CVE-2022-40608 IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the… 5.9 Medium CVE-2022-22472 IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through… 6.0 Medium CVE-2022-22396 Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in… 6.8 Medium
Track this CVE